ecorpfnbhelp[.]icu

Analysis of ecorpfnbhelp.icu indicates that the domain is currently active and has been identified as a phishing infrastructure. The domain was registered on July 17 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is delegated to Cloudflare name servers joaquin.ns.cloudflare.com and lilyana.ns.cloudflare.com. DNS resolution points to the IP address 188.114.97.3, which is the sole host observed for this domain. The domain appears on a security blocklist and is specifically blocked by the PhishDestroy service, confirming that threat‑intelligence feeds have categorized it as malicious. VirusTotal records show that the domain was scanned by 95 antivirus and URL‑reputation vendors; none reported a detection at the time of scanning, but the absence of detections does not constitute evidence of safety. No publicly available page title, SSL certificate details, HTTP response codes, or Safe‑Browsing verdicts are present in the current intelligence set, leaving the content and exact phishing lure unknown. Given the recent creation date, active status, association with a known blocklist, and resolution to a single IP address, defenders should treat ecorpfnbhelp.icu as a high‑confidence phishing indicator. Recommended remediation actions include adding the domain and its resolving IP to network‑level deny lists, updating DNS‑filtering rules, monitoring for any new sub‑domains or related IP activity, and continuing to track the domain for potential evolution of the payload or associated infrastructure. The limited evidence base warrants ongoing observation, but the existing indicators are sufficient to justify immediate blocking and heightened alerting for any traffic targeting this domain.